Skip to main content
Security ArchitectListed as a primary cert for that lane. Back to pathway
Back to certifications

ISC2 · Senior security governance

CISSP

Apply a broad set of security principles across people, process and technology.

View certification details
Connect security decisions to business risk

Explain what needs protecting, who owns the risk and which trade-offs require a decision.

Review controls across the whole system

Connect architecture, identity, operations and assurance rather than treating each control in isolation.

Make a recommendation you can defend

Record assumptions, evidence gaps and the conditions under which a design could be accepted.

What you will learn to do

Connect security decisions to business risk

Explain what needs protecting, who owns the risk and which trade-offs require a decision.

Review controls across the whole system

Connect architecture, identity, operations and assurance rather than treating each control in isolation.

Make a recommendation you can defend

Record assumptions, evidence gaps and the conditions under which a design could be accepted.

Certification essentials

Requirements, costs and keeping it current.

Check the vendor record and ongoing commitment alongside the career guidance.

Pricing view
Market

Vendor record

Live

Live and unchanged in name. Candidates without the required experience can sit the exam and hold Associate of ISC2 status for six years while they earn it.

Source: ISC2 · Read 22 September 2026

Sourced fields only; this does not mean every exam detail has been verified. Pricing and renewal policies have their own sources and check dates. Confirm the currency, tax and final booking total with the vendor.

Role-fit guidance is TechWaymark editorial interpretation. It is separate from the recorded vendor facts and does not measure hiring outcomes.

Costs and renewal

Exam cost
£606.69
Exam format
CAT exam, 100–150 questions, up to 3 hours · TechWaymark-held detail; confirm the exam version with the vendor
Keeping it current

Submit 120 CPE credits over each 3-year cycle, including at least 90 Group A credits, and pay the annual maintenance fee.

Renewal sources & exceptions

One annual fee covers multiple ISC2 certifications. The published annual CPE figures are suggested pacing, not separate annual minimums.

Renewal policy checked 2026-09-28. Check the linked provider policy for current fees and eligibility.

Standard exam registration. Training, maintenance fees and retakes are separate; confirm applicable tax at booking. Vendor price checked 2026-09-24. Check the vendor record before booking.

Current vendor pricing source ↗
Preparation and practical skills

Recommended prior knowledge

  • 5+ years cumulative paid security experience (2 of the 8 domains)
  • Broad exposure across security, networking, and risk
  • Comfort with policy / governance concepts

Common misconceptions

  • CISSP is technical, it's primarily governance & architecture.
  • It's a 'first' senior cert, most pursue with 5+ yrs experience.

What this cert does NOT guarantee

  • Hands-on engineering roles
  • Management title automatically

Practical skills that matter

  • Risk management
  • Security architecture
  • Policy & governance
  • Incident response leadership
  • Stakeholder communication
Alternatives and related certifications

Where this fits

  • None required
This cert
CISSP
  • Top of this lane

Alternative routes

No single right path. These adjacent options reach similar roles.

  • CISM
    ISACA's management-focused alternative, often preferred for governance roles.
  • CCSP
    (ISC)²'s cloud security cert, better fit for cloud security specialists.
  • Experience first
    Many senior engineers skip CISSP entirely; portfolio + tenure speaks louder.

Adjacent & overlapping

  • CISM
  • CCSP
  • CRISC
  • SABSA
  • TOGAF
  • cism
  • CCSP
Career outcomes and limitations

Realistic first roles

Security Manager
Security Architect
GRC Lead
CISO (with additional experience)
UK role salary estimate
£75k–£115k
TechWaymark practitioner estimate, not survey data. Varies meaningfully by country and employer tier.

How people actually get here

  • Senior SOC / IR analyst
  • Security engineer
  • Compliance / audit lead
  • Network architect moving into security
Market saturation · Moderate

Real-world career variations

Security architect
GRC manager
Security consultant
vCISO

Timeline expectations

  1. Months 0–2Foundation reading, concepts, vocabulary.
  2. Months 2–4Hands-on labs, documented home projects.
  3. Months 4–6Practice exams, weak-area drills, exam.
  4. Post-examUse target vacancies to guide applications and projects. There is no guaranteed time to a first role.

Study resources

Study options

Choose the right mix for your goals and experience. Links below go to official and third-party resources.

Guided study

Structured resources from established providers can help build knowledge and skills.

Compare study options →

Third-party providers. Commercial terms, pricing and availability apply.

Practice environments

Explore suitable environments for practical work. Check the tools, features and access you need.

Compare practice resources →

External resources. Check current costs and access requirements.

Resources are selected for relevance. Compare access, syllabus coverage and total cost; a listing does not imply a commercial partnership.

Compare the resources for CISSP
Exam outlineProvider source

(ISC)² CISSP Exam Outline (current)

Reading

Free resource; confirm current access terms
View resource
TrainingProvider source

(ISC)² Official CISSP Online Self-Paced Training

Video + Reading

Check the resource provider for current local pricing
View resource
BookExternal resource

Official (ISC)² CISSP Study Guide (Chapple, 10th ed.)

Reading

Check the resource provider for current local pricing
View resource
BookExternal resource

Destination CISSP (Concise Guide)

Reading

Check the resource provider for current local pricing
View resource
PracticeExternal resource

Boson CISSP Practice Exams (ExSim-Max)

Quiz

Check the resource provider for current local pricing
View resource
CourseExternal resource

Pete Zerger CISSP Exam Cram (YouTube)

Video

Free resource; confirm current access terms
View resource

Check the current syllabus, access terms and total cost before choosing. Resource inclusion does not guarantee exam success.

Optional home projects

Build something you can explain.

Ideas to explore after choosing a certification, using your own tools and keeping evidence of your work.

Example project evidence
Project evidence map (example)
Annotated access diagramScope and inputs
Security findings registerDecisions and reasoning
Options and recommendationChecks and limitations
Evidence record (example)
Design concernPossible consequenceProposed improvement
Shared supplier administrator accountIndividual actions cannot be attributed reliablyNamed access with appropriate privileges and review

Review a supplier access design

A supplier wants shared administrator access to support a customer platform. The business needs support coverage while retaining accountability and control over sensitive data.

Design project Your own tools Evidence guidance
View project guide
Track this certification

Editorial route and career guidance. No separate external evidence review is recorded for this assessment.

Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.

Before you commit

A practitioner's perspective